From 6f50591f4d2b1d8a1735a97d6906da455795c9dd Mon Sep 17 00:00:00 2001 From: Nick Gagliardi Date: Wed, 30 Sep 2026 14:24:43 -0400 Subject: [PATCH 1/3] follow-on to @amanda's PR #263 to clean up experimental endpoints --- authzen/v1/authzen_service.proto | 88 ++++++++++++++++---------------- 1 file changed, 45 insertions(+), 43 deletions(-) diff --git a/authzen/v1/authzen_service.proto b/authzen/v1/authzen_service.proto index 38347b22..28caae5a 100644 --- a/authzen/v1/authzen_service.proto +++ b/authzen/v1/authzen_service.proto @@ -18,29 +18,29 @@ service AuthZenService { }; option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = { - summary: "[Experimental] Evaluate whether a subject can perform an action on a resource" + summary: "[Experimental] Check whether a subject can perform an action on a resource" operation_id: "Evaluation" description: "[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. " "This endpoint implements the AuthZEN Access Evaluation API specification.\n\n" - "## Request Structure\n" - "The request requires three components:\n" + "## Request Structure\n\n" + "The request requires three components:\n\n" "- **subject**: The entity requesting access (e.g., a user or service)\n" "- **action**: The operation being performed (maps to a relation in the authorization model)\n" "- **resource**: The object being accessed\n\n" "Each component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n\n" - "## Response\n" + "## Response\n\n" "The response contains a `decision` field (boolean) indicating whether access is permitted, " "and an optional `context` object with additional information such as the evaluation ID or error details.\n\n" - "## ABAC Support\n" - "Properties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n" + "## ABAC Support\n\n" + "Properties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n\n" "- Subject properties: `subject_`\n" "- Resource properties: `resource_`\n" "- Action properties: `action_`\n\n" "These merged properties can be used in conditions defined in your authorization model.\n\n" - "## Examples\n" - "### Basic authorization check\n" + "## Examples\n\n" + "### Basic authorization check\n\n" "Check if user Anne can read a document:\n" "```json\n" "{\n" @@ -54,8 +54,8 @@ service AuthZenService { "{\n" " \"decision\": true\n" "}\n" - "```\n" - "### Using properties for ABAC\n" + "```\n\n" + "### Using properties for ABAC\n\n" "Check access with subject and resource attributes:\n" "```json\n" "{\n" @@ -71,8 +71,8 @@ service AuthZenService { " \"properties\": {\"classification\": \"confidential\", \"required_clearance\": 2}\n" " }\n" "}\n" - "```\n" - "### Using request context\n" + "```\n\n" + "### Using request context\n\n" "Provide additional context for time-based or environmental conditions:\n" "```json\n" "{\n" @@ -85,8 +85,8 @@ service AuthZenService { " \"is_vpn_connected\": true\n" " }\n" "}\n" - "```\n" - "### Specifying authorization model\n" + "```\n\n" + "### Specifying authorization model\n\n" "Pin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n" "```\n" "POST /stores/{store_id}/access/v1/evaluation\n" @@ -108,22 +108,22 @@ service AuthZenService { }; option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = { - summary: "[Experimental] Check whether one or more users are authorized to access resources" + summary: "[Experimental] Check multiple authorizations in a single request" operation_id: "Evaluations" description: "[Experimental] The Evaluations API allows batch authorization checks in a single request. " "It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n\n" - "## Evaluation Semantics\n" - "The `options.evaluations_semantic` field controls how evaluations are processed:\n" + "## Evaluation Semantics\n\n" + "The `options.evaluations_semantic` field controls how evaluations are processed:\n\n" "- `execute_all` (default): Execute all evaluations and return all results\n" "- `deny_on_first_deny`: Stop processing on first deny decision\n" "- `permit_on_first_permit`: Stop processing on first permit decision\n\n" "When using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n\n" - "## Authorization Model Selection\n" + "## Authorization Model Selection\n\n" "To pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n\n" - "## Examples\n" - "### Basic batch evaluation\n" + "## Examples\n\n" + "### Basic batch evaluation\n\n" "Check if a user can perform multiple actions on a document:\n" "```json\n" "{\n" @@ -135,8 +135,8 @@ service AuthZenService { " {\"action\": {\"name\": \"can_delete\"}}\n" " ]\n" "}\n" - "```\n" - "### Using evaluation semantics\n" + "```\n\n" + "### Using evaluation semantics\n\n" "Stop on first permitted action (useful for finding any valid permission):\n" "```json\n" "{\n" @@ -150,8 +150,8 @@ service AuthZenService { " \"evaluations_semantic\": \"permit_on_first_permit\"\n" " }\n" "}\n" - "```\n" - "### Overriding defaults per evaluation\n" + "```\n\n" + "### Overriding defaults per evaluation\n\n" "Check permissions across multiple resources:\n" "```json\n" "{\n" @@ -181,8 +181,9 @@ service AuthZenService { "[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. " "This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n\n" "Results can be filtered by subject type and support pagination for large result sets.\n\n" - "## Examples\n" - "### Find all users who can read a document\n" + "> **Note:** The `subject.id` field may be provided but is ignored, per the AuthZEN spec — only `subject.type` is used to filter results.\n\n" + "## Examples\n\n" + "### Find all users who can read a document\n\n" "```json\n" "{\n" " \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n" @@ -200,8 +201,8 @@ service AuthZenService { " ],\n" " \"page\": {\"count\": 3}\n" "}\n" - "```\n" - "### Paginated search with limit\n" + "```\n\n" + "### Paginated search with limit\n\n" "```json\n" "{\n" " \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n" @@ -209,8 +210,8 @@ service AuthZenService { " \"subject\": {\"type\": \"user\"},\n" " \"page\": {\"limit\": 10}\n" "}\n" - "```\n" - "### Continue from previous page\n" + "```\n\n" + "### Continue from previous page\n\n" "```json\n" "{\n" " \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n" @@ -236,8 +237,9 @@ service AuthZenService { "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. " "This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n\n" "The resource type filter is required. Results support pagination for large result sets.\n\n" - "## Examples\n" - "### Find all documents a user can read\n" + "> **Note:** The `resource.id` field may be provided but is ignored, per the AuthZEN spec — only `resource.type` is used to filter results.\n\n" + "## Examples\n\n" + "### Find all documents a user can read\n\n" "```json\n" "{\n" " \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n" @@ -255,8 +257,8 @@ service AuthZenService { " ],\n" " \"page\": {\"count\": 3}\n" "}\n" - "```\n" - "### Find folders a user can administer with pagination\n" + "```\n\n" + "### Find folders a user can administer with pagination\n\n" "```json\n" "{\n" " \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n" @@ -264,8 +266,8 @@ service AuthZenService { " \"resource\": {\"type\": \"folder\"},\n" " \"page\": {\"limit\": 25}\n" "}\n" - "```\n" - "### Search with ABAC context\n" + "```\n\n" + "### Search with ABAC context\n\n" "```json\n" "{\n" " \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n" @@ -294,8 +296,8 @@ service AuthZenService { "[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. " "This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs " "that show only the actions a user is permitted to perform.\n\n" - "## Examples\n" - "### Find all actions a user can perform on a document\n" + "## Examples\n\n" + "### Find all actions a user can perform on a document\n\n" "```json\n" "{\n" " \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n" @@ -312,8 +314,8 @@ service AuthZenService { " ],\n" " \"page\": {\"count\": 3}\n" "}\n" - "```\n" - "### Search with ABAC context for time-based permissions\n" + "```\n\n" + "### Search with ABAC context for time-based permissions\n\n" "```json\n" "{\n" " \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n" @@ -323,8 +325,8 @@ service AuthZenService { " \"user_department\": \"finance\"\n" " }\n" "}\n" - "```\n" - "### Paginated action search\n" + "```\n\n" + "### Paginated action search\n\n" "```json\n" "{\n" " \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n" @@ -347,7 +349,7 @@ service AuthZenService { "supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n\n" "Following the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at " "`/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n\n" - "## Example Response\n" + "## Example Response\n\n" "```json\n" "{\n" " \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n" From 8ffd0d48e762d543f3ef0f76839a5f23e08e6d74 Mon Sep 17 00:00:00 2001 From: Nick Gagliardi Date: Wed, 30 Sep 2026 14:37:49 -0400 Subject: [PATCH 2/3] regen/commit derived files for CI to resolve failing tests --- docs/openapiv2/apidocs.swagger.json | 18 +++--- docs/openapiv3/apidocs.openapi.json | 18 +++--- proto/authzen/v1/authzen_service.pb.go | 76 +++++++++++++++++++++----- 3 files changed, 79 insertions(+), 33 deletions(-) diff --git a/docs/openapiv2/apidocs.swagger.json b/docs/openapiv2/apidocs.swagger.json index 64ee5953..5d687b79 100644 --- a/docs/openapiv2/apidocs.swagger.json +++ b/docs/openapiv2/apidocs.swagger.json @@ -35,7 +35,7 @@ "/.well-known/authzen-configuration/{store_id}": { "get": { "summary": "[Experimental] Get AuthZEN PDP configuration and capabilities", - "description": "[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n\nFollowing the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at `/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n\n## Example Response\n```json\n{\n \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n \"access_evaluation_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluation\",\n \"access_evaluations_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluations\",\n \"search_subject_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/subject\",\n \"search_resource_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/resource\",\n \"search_action_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/action\"\n}\n```\n", + "description": "[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n\nFollowing the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at `/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n\n## Example Response\n\n```json\n{\n \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n \"access_evaluation_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluation\",\n \"access_evaluations_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluations\",\n \"search_subject_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/subject\",\n \"search_resource_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/resource\",\n \"search_action_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/action\"\n}\n```\n", "operationId": "GetConfiguration", "responses": { "200": { @@ -384,8 +384,8 @@ }, "/stores/{store_id}/access/v1/evaluation": { "post": { - "summary": "[Experimental] Evaluate whether a subject can perform an action on a resource", - "description": "[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n\n## Request Structure\nThe request requires three components:\n- **subject**: The entity requesting access (e.g., a user or service)\n- **action**: The operation being performed (maps to a relation in the authorization model)\n- **resource**: The object being accessed\n\nEach component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n\n## Response\nThe response contains a `decision` field (boolean) indicating whether access is permitted, and an optional `context` object with additional information such as the evaluation ID or error details.\n\n## ABAC Support\nProperties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n- Subject properties: `subject_`\n- Resource properties: `resource_`\n- Action properties: `action_`\n\nThese merged properties can be used in conditions defined in your authorization model.\n\n## Examples\n### Basic authorization check\nCheck if user Anne can read a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse when authorized:\n```json\n{\n \"decision\": true\n}\n```\n### Using properties for ABAC\nCheck access with subject and resource attributes:\n```json\n{\n \"subject\": {\n \"type\": \"user\",\n \"id\": \"anne\",\n \"properties\": {\"department\": \"engineering\", \"clearance_level\": 3}\n },\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\n \"type\": \"document\",\n \"id\": \"secret-project\",\n \"properties\": {\"classification\": \"confidential\", \"required_clearance\": 2}\n }\n}\n```\n### Using request context\nProvide additional context for time-based or environmental conditions:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_access\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"ip_address\": \"192.168.1.100\",\n \"is_vpn_connected\": true\n }\n}\n```\n### Specifying authorization model\nPin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n```\nPOST /stores/{store_id}/access/v1/evaluation\nOpenfga-Authorization-Model-Id: 01G50QVV17PECNVAHX1GG4Y5NC\n\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_write\"},\n \"resource\": {\"type\": \"document\", \"id\": \"budget-2024\"}\n}\n```\n", + "summary": "[Experimental] Check whether a subject can perform an action on a resource", + "description": "[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n\n## Request Structure\n\nThe request requires three components:\n\n- **subject**: The entity requesting access (e.g., a user or service)\n- **action**: The operation being performed (maps to a relation in the authorization model)\n- **resource**: The object being accessed\n\nEach component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n\n## Response\n\nThe response contains a `decision` field (boolean) indicating whether access is permitted, and an optional `context` object with additional information such as the evaluation ID or error details.\n\n## ABAC Support\n\nProperties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n\n- Subject properties: `subject_`\n- Resource properties: `resource_`\n- Action properties: `action_`\n\nThese merged properties can be used in conditions defined in your authorization model.\n\n## Examples\n\n### Basic authorization check\n\nCheck if user Anne can read a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse when authorized:\n```json\n{\n \"decision\": true\n}\n```\n\n### Using properties for ABAC\n\nCheck access with subject and resource attributes:\n```json\n{\n \"subject\": {\n \"type\": \"user\",\n \"id\": \"anne\",\n \"properties\": {\"department\": \"engineering\", \"clearance_level\": 3}\n },\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\n \"type\": \"document\",\n \"id\": \"secret-project\",\n \"properties\": {\"classification\": \"confidential\", \"required_clearance\": 2}\n }\n}\n```\n\n### Using request context\n\nProvide additional context for time-based or environmental conditions:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_access\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"ip_address\": \"192.168.1.100\",\n \"is_vpn_connected\": true\n }\n}\n```\n\n### Specifying authorization model\n\nPin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n```\nPOST /stores/{store_id}/access/v1/evaluation\nOpenfga-Authorization-Model-Id: 01G50QVV17PECNVAHX1GG4Y5NC\n\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_write\"},\n \"resource\": {\"type\": \"document\", \"id\": \"budget-2024\"}\n}\n```\n", "operationId": "Evaluation", "responses": { "200": { @@ -460,8 +460,8 @@ }, "/stores/{store_id}/access/v1/evaluations": { "post": { - "summary": "[Experimental] Check whether one or more users are authorized to access resources", - "description": "[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n\n## Evaluation Semantics\nThe `options.evaluations_semantic` field controls how evaluations are processed:\n- `execute_all` (default): Execute all evaluations and return all results\n- `deny_on_first_deny`: Stop processing on first deny decision\n- `permit_on_first_permit`: Stop processing on first permit decision\n\nWhen using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n\n## Authorization Model Selection\nTo pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n\n## Examples\n### Basic batch evaluation\nCheck if a user can perform multiple actions on a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}},\n {\"action\": {\"name\": \"can_delete\"}}\n ]\n}\n```\n### Using evaluation semantics\nStop on first permitted action (useful for finding any valid permission):\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}}\n ],\n \"options\": {\n \"evaluations_semantic\": \"permit_on_first_permit\"\n }\n}\n```\n### Overriding defaults per evaluation\nCheck permissions across multiple resources:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"evaluations\": [\n {\"resource\": {\"type\": \"document\", \"id\": \"doc1\"}},\n {\"resource\": {\"type\": \"document\", \"id\": \"doc2\"}},\n {\"resource\": {\"type\": \"folder\", \"id\": \"folder1\"}}\n ]\n}\n```\n", + "summary": "[Experimental] Check multiple authorizations in a single request", + "description": "[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n\n## Evaluation Semantics\n\nThe `options.evaluations_semantic` field controls how evaluations are processed:\n\n- `execute_all` (default): Execute all evaluations and return all results\n- `deny_on_first_deny`: Stop processing on first deny decision\n- `permit_on_first_permit`: Stop processing on first permit decision\n\nWhen using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n\n## Authorization Model Selection\n\nTo pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n\n## Examples\n\n### Basic batch evaluation\n\nCheck if a user can perform multiple actions on a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}},\n {\"action\": {\"name\": \"can_delete\"}}\n ]\n}\n```\n\n### Using evaluation semantics\n\nStop on first permitted action (useful for finding any valid permission):\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}}\n ],\n \"options\": {\n \"evaluations_semantic\": \"permit_on_first_permit\"\n }\n}\n```\n\n### Overriding defaults per evaluation\n\nCheck permissions across multiple resources:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"evaluations\": [\n {\"resource\": {\"type\": \"document\", \"id\": \"doc1\"}},\n {\"resource\": {\"type\": \"document\", \"id\": \"doc2\"}},\n {\"resource\": {\"type\": \"folder\", \"id\": \"folder1\"}}\n ]\n}\n```\n", "operationId": "Evaluations", "responses": { "200": { @@ -537,7 +537,7 @@ "/stores/{store_id}/access/v1/search/action": { "post": { "summary": "[Experimental] Search for actions a subject can perform on a resource", - "description": "[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n\n## Examples\n### Find all actions a user can perform on a document\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"name\": \"can_read\"},\n {\"name\": \"can_write\"},\n {\"name\": \"can_share\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Search with ABAC context for time-based permissions\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"resource\": {\"type\": \"report\", \"id\": \"quarterly-financials\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"user_department\": \"finance\"\n }\n}\n```\n### Paginated action search\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"page\": {\"limit\": 50}\n}\n```\n", + "description": "[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n\n## Examples\n\n### Find all actions a user can perform on a document\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"name\": \"can_read\"},\n {\"name\": \"can_write\"},\n {\"name\": \"can_share\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n\n### Search with ABAC context for time-based permissions\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"resource\": {\"type\": \"report\", \"id\": \"quarterly-financials\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"user_department\": \"finance\"\n }\n}\n```\n\n### Paginated action search\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"page\": {\"limit\": 50}\n}\n```\n", "operationId": "ActionSearch", "responses": { "200": { @@ -613,7 +613,7 @@ "/stores/{store_id}/access/v1/search/resource": { "post": { "summary": "[Experimental] Search for resources a subject has access to", - "description": "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n\nThe resource type filter is required. Results support pagination for large result sets.\n\n## Examples\n### Find all documents a user can read\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"document\", \"id\": \"roadmap\"},\n {\"type\": \"document\", \"id\": \"budget-2024\"},\n {\"type\": \"document\", \"id\": \"team-roster\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Find folders a user can administer with pagination\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_admin\"},\n \"resource\": {\"type\": \"folder\"},\n \"page\": {\"limit\": 25}\n}\n```\n### Search with ABAC context\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"},\n \"context\": {\n \"current_time\": \"2024-01-15T10:00:00Z\",\n \"ip_address\": \"192.168.1.100\"\n }\n}\n```\n", + "description": "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n\nThe resource type filter is required. Results support pagination for large result sets.\n\n> **Note:** The `resource.id` field may be provided but is ignored, per the AuthZEN spec — only `resource.type` is used to filter results.\n\n## Examples\n\n### Find all documents a user can read\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"document\", \"id\": \"roadmap\"},\n {\"type\": \"document\", \"id\": \"budget-2024\"},\n {\"type\": \"document\", \"id\": \"team-roster\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n\n### Find folders a user can administer with pagination\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_admin\"},\n \"resource\": {\"type\": \"folder\"},\n \"page\": {\"limit\": 25}\n}\n```\n\n### Search with ABAC context\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"},\n \"context\": {\n \"current_time\": \"2024-01-15T10:00:00Z\",\n \"ip_address\": \"192.168.1.100\"\n }\n}\n```\n", "operationId": "ResourceSearch", "responses": { "200": { @@ -689,7 +689,7 @@ "/stores/{store_id}/access/v1/search/subject": { "post": { "summary": "[Experimental] Search for subjects with access to a resource", - "description": "[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n\nResults can be filtered by subject type and support pagination for large result sets.\n\n## Examples\n### Find all users who can read a document\n```json\n{\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"action\": {\"name\": \"can_read\"},\n \"subject\": {\"type\": \"user\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"user\", \"id\": \"anne\"},\n {\"type\": \"user\", \"id\": \"bob\"},\n {\"type\": \"user\", \"id\": \"charlie\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Paginated search with limit\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"limit\": 10}\n}\n```\n### Continue from previous page\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"token\": \"eyJsYXN0X2lkIjoiMTAwIn0=\", \"limit\": 10}\n}\n```\n", + "description": "[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n\nResults can be filtered by subject type and support pagination for large result sets.\n\n> **Note:** The `subject.id` field may be provided but is ignored, per the AuthZEN spec — only `subject.type` is used to filter results.\n\n## Examples\n\n### Find all users who can read a document\n\n```json\n{\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"action\": {\"name\": \"can_read\"},\n \"subject\": {\"type\": \"user\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"user\", \"id\": \"anne\"},\n {\"type\": \"user\", \"id\": \"bob\"},\n {\"type\": \"user\", \"id\": \"charlie\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n\n### Paginated search with limit\n\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"limit\": 10}\n}\n```\n\n### Continue from previous page\n\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"token\": \"eyJsYXN0X2lkIjoiMTAwIn0=\", \"limit\": 10}\n}\n```\n", "operationId": "SubjectSearch", "responses": { "200": { @@ -2953,7 +2953,7 @@ "NULL_VALUE" ], "default": "NULL_VALUE", - "description": "`NullValue` is a singleton enumeration to represent the null value for the\n`Value` type union.\n\nThe JSON representation for `NullValue` is JSON `null`.\n\n - NULL_VALUE: Null value." + "description": "Represents a JSON `null`.\n\n`NullValue` is a sentinel, using an enum with only one value to represent\nthe null value for the `Value` type union.\n\nA field of type `NullValue` with any value other than `0` is considered\ninvalid. Most ProtoJSON serializers will emit a Value with a `null_value` set\nas a JSON `null` regardless of the integer value, and so will round trip to\na `0` value.\n\n - NULL_VALUE: Null value." }, "Object": { "type": "object", diff --git a/docs/openapiv3/apidocs.openapi.json b/docs/openapiv3/apidocs.openapi.json index de1ca30f..1028b35b 100644 --- a/docs/openapiv3/apidocs.openapi.json +++ b/docs/openapiv3/apidocs.openapi.json @@ -1220,7 +1220,7 @@ }, "NullValue": { "default": "NULL_VALUE", - "description": "`NullValue` is a singleton enumeration to represent the null value for the\n`Value` type union.\n\nThe JSON representation for `NullValue` is JSON `null`.\n\n - NULL_VALUE: Null value.", + "description": "Represents a JSON `null`.\n\n`NullValue` is a sentinel, using an enum with only one value to represent\nthe null value for the `Value` type union.\n\nA field of type `NullValue` with any value other than `0` is considered\ninvalid. Most ProtoJSON serializers will emit a Value with a `null_value` set\nas a JSON `null` regardless of the integer value, and so will round trip to\na `0` value.\n\n - NULL_VALUE: Null value.", "enum": [ "NULL_VALUE" ], @@ -2456,7 +2456,7 @@ "paths": { "/.well-known/authzen-configuration/{store_id}": { "get": { - "description": "[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n\nFollowing the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at `/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n\n## Example Response\n```json\n{\n \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n \"access_evaluation_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluation\",\n \"access_evaluations_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluations\",\n \"search_subject_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/subject\",\n \"search_resource_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/resource\",\n \"search_action_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/action\"\n}\n```\n", + "description": "[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n\nFollowing the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at `/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n\n## Example Response\n\n```json\n{\n \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n \"access_evaluation_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluation\",\n \"access_evaluations_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluations\",\n \"search_subject_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/subject\",\n \"search_resource_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/resource\",\n \"search_action_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/action\"\n}\n```\n", "operationId": "GetConfiguration", "parameters": [ { @@ -2974,7 +2974,7 @@ }, "/stores/{store_id}/access/v1/evaluation": { "post": { - "description": "[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n\n## Request Structure\nThe request requires three components:\n- **subject**: The entity requesting access (e.g., a user or service)\n- **action**: The operation being performed (maps to a relation in the authorization model)\n- **resource**: The object being accessed\n\nEach component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n\n## Response\nThe response contains a `decision` field (boolean) indicating whether access is permitted, and an optional `context` object with additional information such as the evaluation ID or error details.\n\n## ABAC Support\nProperties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n- Subject properties: `subject_`\n- Resource properties: `resource_`\n- Action properties: `action_`\n\nThese merged properties can be used in conditions defined in your authorization model.\n\n## Examples\n### Basic authorization check\nCheck if user Anne can read a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse when authorized:\n```json\n{\n \"decision\": true\n}\n```\n### Using properties for ABAC\nCheck access with subject and resource attributes:\n```json\n{\n \"subject\": {\n \"type\": \"user\",\n \"id\": \"anne\",\n \"properties\": {\"department\": \"engineering\", \"clearance_level\": 3}\n },\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\n \"type\": \"document\",\n \"id\": \"secret-project\",\n \"properties\": {\"classification\": \"confidential\", \"required_clearance\": 2}\n }\n}\n```\n### Using request context\nProvide additional context for time-based or environmental conditions:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_access\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"ip_address\": \"192.168.1.100\",\n \"is_vpn_connected\": true\n }\n}\n```\n### Specifying authorization model\nPin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n```\nPOST /stores/{store_id}/access/v1/evaluation\nOpenfga-Authorization-Model-Id: 01G50QVV17PECNVAHX1GG4Y5NC\n\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_write\"},\n \"resource\": {\"type\": \"document\", \"id\": \"budget-2024\"}\n}\n```\n", + "description": "[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n\n## Request Structure\n\nThe request requires three components:\n\n- **subject**: The entity requesting access (e.g., a user or service)\n- **action**: The operation being performed (maps to a relation in the authorization model)\n- **resource**: The object being accessed\n\nEach component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n\n## Response\n\nThe response contains a `decision` field (boolean) indicating whether access is permitted, and an optional `context` object with additional information such as the evaluation ID or error details.\n\n## ABAC Support\n\nProperties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n\n- Subject properties: `subject_`\n- Resource properties: `resource_`\n- Action properties: `action_`\n\nThese merged properties can be used in conditions defined in your authorization model.\n\n## Examples\n\n### Basic authorization check\n\nCheck if user Anne can read a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse when authorized:\n```json\n{\n \"decision\": true\n}\n```\n\n### Using properties for ABAC\n\nCheck access with subject and resource attributes:\n```json\n{\n \"subject\": {\n \"type\": \"user\",\n \"id\": \"anne\",\n \"properties\": {\"department\": \"engineering\", \"clearance_level\": 3}\n },\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\n \"type\": \"document\",\n \"id\": \"secret-project\",\n \"properties\": {\"classification\": \"confidential\", \"required_clearance\": 2}\n }\n}\n```\n\n### Using request context\n\nProvide additional context for time-based or environmental conditions:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_access\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"ip_address\": \"192.168.1.100\",\n \"is_vpn_connected\": true\n }\n}\n```\n\n### Specifying authorization model\n\nPin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n```\nPOST /stores/{store_id}/access/v1/evaluation\nOpenfga-Authorization-Model-Id: 01G50QVV17PECNVAHX1GG4Y5NC\n\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_write\"},\n \"resource\": {\"type\": \"document\", \"id\": \"budget-2024\"}\n}\n```\n", "operationId": "Evaluation", "parameters": [ { @@ -3078,7 +3078,7 @@ "description": "Request failed due to internal server error." } }, - "summary": "[Experimental] Evaluate whether a subject can perform an action on a resource", + "summary": "[Experimental] Check whether a subject can perform an action on a resource", "tags": [ "AuthZenService" ] @@ -3086,7 +3086,7 @@ }, "/stores/{store_id}/access/v1/evaluations": { "post": { - "description": "[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n\n## Evaluation Semantics\nThe `options.evaluations_semantic` field controls how evaluations are processed:\n- `execute_all` (default): Execute all evaluations and return all results\n- `deny_on_first_deny`: Stop processing on first deny decision\n- `permit_on_first_permit`: Stop processing on first permit decision\n\nWhen using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n\n## Authorization Model Selection\nTo pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n\n## Examples\n### Basic batch evaluation\nCheck if a user can perform multiple actions on a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}},\n {\"action\": {\"name\": \"can_delete\"}}\n ]\n}\n```\n### Using evaluation semantics\nStop on first permitted action (useful for finding any valid permission):\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}}\n ],\n \"options\": {\n \"evaluations_semantic\": \"permit_on_first_permit\"\n }\n}\n```\n### Overriding defaults per evaluation\nCheck permissions across multiple resources:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"evaluations\": [\n {\"resource\": {\"type\": \"document\", \"id\": \"doc1\"}},\n {\"resource\": {\"type\": \"document\", \"id\": \"doc2\"}},\n {\"resource\": {\"type\": \"folder\", \"id\": \"folder1\"}}\n ]\n}\n```\n", + "description": "[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n\n## Evaluation Semantics\n\nThe `options.evaluations_semantic` field controls how evaluations are processed:\n\n- `execute_all` (default): Execute all evaluations and return all results\n- `deny_on_first_deny`: Stop processing on first deny decision\n- `permit_on_first_permit`: Stop processing on first permit decision\n\nWhen using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n\n## Authorization Model Selection\n\nTo pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n\n## Examples\n\n### Basic batch evaluation\n\nCheck if a user can perform multiple actions on a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}},\n {\"action\": {\"name\": \"can_delete\"}}\n ]\n}\n```\n\n### Using evaluation semantics\n\nStop on first permitted action (useful for finding any valid permission):\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}}\n ],\n \"options\": {\n \"evaluations_semantic\": \"permit_on_first_permit\"\n }\n}\n```\n\n### Overriding defaults per evaluation\n\nCheck permissions across multiple resources:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"evaluations\": [\n {\"resource\": {\"type\": \"document\", \"id\": \"doc1\"}},\n {\"resource\": {\"type\": \"document\", \"id\": \"doc2\"}},\n {\"resource\": {\"type\": \"folder\", \"id\": \"folder1\"}}\n ]\n}\n```\n", "operationId": "Evaluations", "parameters": [ { @@ -3190,7 +3190,7 @@ "description": "Request failed due to internal server error." } }, - "summary": "[Experimental] Check whether one or more users are authorized to access resources", + "summary": "[Experimental] Check multiple authorizations in a single request", "tags": [ "AuthZenService" ] @@ -3198,7 +3198,7 @@ }, "/stores/{store_id}/access/v1/search/action": { "post": { - "description": "[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n\n## Examples\n### Find all actions a user can perform on a document\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"name\": \"can_read\"},\n {\"name\": \"can_write\"},\n {\"name\": \"can_share\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Search with ABAC context for time-based permissions\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"resource\": {\"type\": \"report\", \"id\": \"quarterly-financials\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"user_department\": \"finance\"\n }\n}\n```\n### Paginated action search\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"page\": {\"limit\": 50}\n}\n```\n", + "description": "[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n\n## Examples\n\n### Find all actions a user can perform on a document\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"name\": \"can_read\"},\n {\"name\": \"can_write\"},\n {\"name\": \"can_share\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n\n### Search with ABAC context for time-based permissions\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"resource\": {\"type\": \"report\", \"id\": \"quarterly-financials\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"user_department\": \"finance\"\n }\n}\n```\n\n### Paginated action search\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"page\": {\"limit\": 50}\n}\n```\n", "operationId": "ActionSearch", "parameters": [ { @@ -3310,7 +3310,7 @@ }, "/stores/{store_id}/access/v1/search/resource": { "post": { - "description": "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n\nThe resource type filter is required. Results support pagination for large result sets.\n\n## Examples\n### Find all documents a user can read\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"document\", \"id\": \"roadmap\"},\n {\"type\": \"document\", \"id\": \"budget-2024\"},\n {\"type\": \"document\", \"id\": \"team-roster\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Find folders a user can administer with pagination\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_admin\"},\n \"resource\": {\"type\": \"folder\"},\n \"page\": {\"limit\": 25}\n}\n```\n### Search with ABAC context\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"},\n \"context\": {\n \"current_time\": \"2024-01-15T10:00:00Z\",\n \"ip_address\": \"192.168.1.100\"\n }\n}\n```\n", + "description": "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n\nThe resource type filter is required. Results support pagination for large result sets.\n\n> **Note:** The `resource.id` field may be provided but is ignored, per the AuthZEN spec — only `resource.type` is used to filter results.\n\n## Examples\n\n### Find all documents a user can read\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"document\", \"id\": \"roadmap\"},\n {\"type\": \"document\", \"id\": \"budget-2024\"},\n {\"type\": \"document\", \"id\": \"team-roster\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n\n### Find folders a user can administer with pagination\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_admin\"},\n \"resource\": {\"type\": \"folder\"},\n \"page\": {\"limit\": 25}\n}\n```\n\n### Search with ABAC context\n\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"},\n \"context\": {\n \"current_time\": \"2024-01-15T10:00:00Z\",\n \"ip_address\": \"192.168.1.100\"\n }\n}\n```\n", "operationId": "ResourceSearch", "parameters": [ { @@ -3422,7 +3422,7 @@ }, "/stores/{store_id}/access/v1/search/subject": { "post": { - "description": "[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n\nResults can be filtered by subject type and support pagination for large result sets.\n\n## Examples\n### Find all users who can read a document\n```json\n{\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"action\": {\"name\": \"can_read\"},\n \"subject\": {\"type\": \"user\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"user\", \"id\": \"anne\"},\n {\"type\": \"user\", \"id\": \"bob\"},\n {\"type\": \"user\", \"id\": \"charlie\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Paginated search with limit\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"limit\": 10}\n}\n```\n### Continue from previous page\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"token\": \"eyJsYXN0X2lkIjoiMTAwIn0=\", \"limit\": 10}\n}\n```\n", + "description": "[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n\nResults can be filtered by subject type and support pagination for large result sets.\n\n> **Note:** The `subject.id` field may be provided but is ignored, per the AuthZEN spec — only `subject.type` is used to filter results.\n\n## Examples\n\n### Find all users who can read a document\n\n```json\n{\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"action\": {\"name\": \"can_read\"},\n \"subject\": {\"type\": \"user\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"user\", \"id\": \"anne\"},\n {\"type\": \"user\", \"id\": \"bob\"},\n {\"type\": \"user\", \"id\": \"charlie\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n\n### Paginated search with limit\n\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"limit\": 10}\n}\n```\n\n### Continue from previous page\n\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"token\": \"eyJsYXN0X2lkIjoiMTAwIn0=\", \"limit\": 10}\n}\n```\n", "operationId": "SubjectSearch", "parameters": [ { diff --git a/proto/authzen/v1/authzen_service.pb.go b/proto/authzen/v1/authzen_service.pb.go index 59a3a60d..53a8a60f 100644 --- a/proto/authzen/v1/authzen_service.pb.go +++ b/proto/authzen/v1/authzen_service.pb.go @@ -1589,13 +1589,15 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + "\x13EvaluationsSemantic\x12\x0f\n" + "\vexecute_all\x10\x00\x12\x16\n" + "\x12deny_on_first_deny\x10\x01\x12\x1a\n" + - "\x16permit_on_first_permit\x10\x022\x99R\n" + - "\x0eAuthZenService\x12\xab\x16\n" + + "\x16permit_on_first_permit\x10\x022\xc8T\n" + + "\x0eAuthZenService\x12\xb5\x16\n" + "\n" + - "Evaluation\x12\x1d.authzen.v1.EvaluationRequest\x1a\x1e.authzen.v1.EvaluationResponse\"\xdd\x15\x92A\xa7\x15\x12M[Experimental] Evaluate whether a subject can perform an action on a resource\x1a\xc9\x14[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n" + + "Evaluation\x12\x1d.authzen.v1.EvaluationRequest\x1a\x1e.authzen.v1.EvaluationResponse\"\xe7\x15\x92A\xb1\x15\x12J[Experimental] Check whether a subject can perform an action on a resource\x1a\xd6\x14[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n" + "\n" + "## Request Structure\n" + + "\n" + "The request requires three components:\n" + + "\n" + "- **subject**: The entity requesting access (e.g., a user or service)\n" + "- **action**: The operation being performed (maps to a relation in the authorization model)\n" + "- **resource**: The object being accessed\n" + @@ -1603,10 +1605,13 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + "Each component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n" + "\n" + "## Response\n" + + "\n" + "The response contains a `decision` field (boolean) indicating whether access is permitted, and an optional `context` object with additional information such as the evaluation ID or error details.\n" + "\n" + "## ABAC Support\n" + + "\n" + "Properties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n" + + "\n" + "- Subject properties: `subject_`\n" + "- Resource properties: `resource_`\n" + "- Action properties: `action_`\n" + @@ -1614,7 +1619,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + "These merged properties can be used in conditions defined in your authorization model.\n" + "\n" + "## Examples\n" + + "\n" + "### Basic authorization check\n" + + "\n" + "Check if user Anne can read a document:\n" + "```json\n" + "{\n" + @@ -1629,7 +1636,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"decision\": true\n" + "}\n" + "```\n" + + "\n" + "### Using properties for ABAC\n" + + "\n" + "Check access with subject and resource attributes:\n" + "```json\n" + "{\n" + @@ -1646,7 +1655,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " }\n" + "}\n" + "```\n" + + "\n" + "### Using request context\n" + + "\n" + "Provide additional context for time-based or environmental conditions:\n" + "```json\n" + "{\n" + @@ -1660,7 +1671,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " }\n" + "}\n" + "```\n" + + "\n" + "### Specifying authorization model\n" + + "\n" + "Pin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n" + "```\n" + "POST /stores/{store_id}/access/v1/evaluation\n" + @@ -1673,11 +1686,13 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + "}\n" + "```\n" + "*\n" + - "Evaluation\x82\xd3\xe4\x93\x02,:\x01*\"'/stores/{store_id}/access/v1/evaluation\x12\xc7\x11\n" + - "\vEvaluations\x12\x1e.authzen.v1.EvaluationsRequest\x1a\x1f.authzen.v1.EvaluationsResponse\"\xf6\x10\x92A\xbf\x10\x12Q[Experimental] Check whether one or more users are authorized to access resources\x1a\xdc\x0f[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n" + + "Evaluation\x82\xd3\xe4\x93\x02,:\x01*\"'/stores/{store_id}/access/v1/evaluation\x12\xbf\x11\n" + + "\vEvaluations\x12\x1e.authzen.v1.EvaluationsRequest\x1a\x1f.authzen.v1.EvaluationsResponse\"\xee\x10\x92A\xb7\x10\x12@[Experimental] Check multiple authorizations in a single request\x1a\xe5\x0f[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n" + "\n" + "## Evaluation Semantics\n" + + "\n" + "The `options.evaluations_semantic` field controls how evaluations are processed:\n" + + "\n" + "- `execute_all` (default): Execute all evaluations and return all results\n" + "- `deny_on_first_deny`: Stop processing on first deny decision\n" + "- `permit_on_first_permit`: Stop processing on first permit decision\n" + @@ -1685,10 +1700,13 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + "When using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n" + "\n" + "## Authorization Model Selection\n" + + "\n" + "To pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n" + "\n" + "## Examples\n" + + "\n" + "### Basic batch evaluation\n" + + "\n" + "Check if a user can perform multiple actions on a document:\n" + "```json\n" + "{\n" + @@ -1701,7 +1719,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " ]\n" + "}\n" + "```\n" + + "\n" + "### Using evaluation semantics\n" + + "\n" + "Stop on first permitted action (useful for finding any valid permission):\n" + "```json\n" + "{\n" + @@ -1716,7 +1736,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " }\n" + "}\n" + "```\n" + + "\n" + "### Overriding defaults per evaluation\n" + + "\n" + "Check permissions across multiple resources:\n" + "```json\n" + "{\n" + @@ -1729,14 +1751,19 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " ]\n" + "}\n" + "```\n" + - "*\vEvaluations\x82\xd3\xe4\x93\x02-:\x01*\"(/stores/{store_id}/access/v1/evaluations\x12\xb1\n" + - "\n" + - "\rSubjectSearch\x12 .authzen.v1.SubjectSearchRequest\x1a!.authzen.v1.SubjectSearchResponse\"\xda\t\x92A\xa0\t\x12<[Experimental] Search for subjects with access to a resource\x1a\xd0\b[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n" + + "*\vEvaluations\x82\xd3\xe4\x93\x02-:\x01*\"(/stores/{store_id}/access/v1/evaluations\x12\xc3\v\n" + + "\rSubjectSearch\x12 .authzen.v1.SubjectSearchRequest\x1a!.authzen.v1.SubjectSearchResponse\"\xec\n" + + "\x92A\xb2\n" + + "\x12<[Experimental] Search for subjects with access to a resource\x1a\xe2\t[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n" + "\n" + "Results can be filtered by subject type and support pagination for large result sets.\n" + "\n" + + "> **Note:** The `subject.id` field may be provided but is ignored, per the AuthZEN spec — only `subject.type` is used to filter results.\n" + + "\n" + "## Examples\n" + + "\n" + "### Find all users who can read a document\n" + + "\n" + "```json\n" + "{\n" + " \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n" + @@ -1755,7 +1782,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"page\": {\"count\": 3}\n" + "}\n" + "```\n" + + "\n" + "### Paginated search with limit\n" + + "\n" + "```json\n" + "{\n" + " \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n" + @@ -1764,7 +1793,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"page\": {\"limit\": 10}\n" + "}\n" + "```\n" + + "\n" + "### Continue from previous page\n" + + "\n" + "```json\n" + "{\n" + " \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n" + @@ -1773,14 +1804,18 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"page\": {\"token\": \"eyJsYXN0X2lkIjoiMTAwIn0=\", \"limit\": 10}\n" + "}\n" + "```\n" + - "*\rSubjectSearch\x82\xd3\xe4\x93\x020:\x01*\"+/stores/{store_id}/access/v1/search/subject\x12\x84\v\n" + - "\x0eResourceSearch\x12!.authzen.v1.ResourceSearchRequest\x1a\".authzen.v1.ResourceSearchResponse\"\xaa\n" + - "\x92A\xef\t\x12;[Experimental] Search for resources a subject has access to\x1a\x9f\t[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n" + + "*\rSubjectSearch\x82\xd3\xe4\x93\x020:\x01*\"+/stores/{store_id}/access/v1/search/subject\x12\x98\f\n" + + "\x0eResourceSearch\x12!.authzen.v1.ResourceSearchRequest\x1a\".authzen.v1.ResourceSearchResponse\"\xbe\v\x92A\x83\v\x12;[Experimental] Search for resources a subject has access to\x1a\xb3\n" + + "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n" + "\n" + "The resource type filter is required. Results support pagination for large result sets.\n" + "\n" + + "> **Note:** The `resource.id` field may be provided but is ignored, per the AuthZEN spec — only `resource.type` is used to filter results.\n" + + "\n" + "## Examples\n" + + "\n" + "### Find all documents a user can read\n" + + "\n" + "```json\n" + "{\n" + " \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n" + @@ -1799,7 +1834,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"page\": {\"count\": 3}\n" + "}\n" + "```\n" + + "\n" + "### Find folders a user can administer with pagination\n" + + "\n" + "```json\n" + "{\n" + " \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n" + @@ -1808,7 +1845,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"page\": {\"limit\": 25}\n" + "}\n" + "```\n" + + "\n" + "### Search with ABAC context\n" + + "\n" + "```json\n" + "{\n" + " \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n" + @@ -1820,12 +1859,14 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " }\n" + "}\n" + "```\n" + - "*\x0eResourceSearch\x82\xd3\xe4\x93\x021:\x01*\",/stores/{store_id}/access/v1/search/resource\x12\x86\n" + + "*\x0eResourceSearch\x82\xd3\xe4\x93\x021:\x01*\",/stores/{store_id}/access/v1/search/resource\x12\x8c\n" + "\n" + - "\fActionSearch\x12\x1f.authzen.v1.ActionSearchRequest\x1a .authzen.v1.ActionSearchResponse\"\xb2\t\x92A\xf9\b\x12E[Experimental] Search for actions a subject can perform on a resource\x1a\xa1\b[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n" + + "\fActionSearch\x12\x1f.authzen.v1.ActionSearchRequest\x1a .authzen.v1.ActionSearchResponse\"\xb8\t\x92A\xff\b\x12E[Experimental] Search for actions a subject can perform on a resource\x1a\xa7\b[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n" + "\n" + "## Examples\n" + + "\n" + "### Find all actions a user can perform on a document\n" + + "\n" + "```json\n" + "{\n" + " \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n" + @@ -1843,7 +1884,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"page\": {\"count\": 3}\n" + "}\n" + "```\n" + + "\n" + "### Search with ABAC context for time-based permissions\n" + + "\n" + "```json\n" + "{\n" + " \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n" + @@ -1854,7 +1897,9 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " }\n" + "}\n" + "```\n" + + "\n" + "### Paginated action search\n" + + "\n" + "```json\n" + "{\n" + " \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n" + @@ -1862,13 +1907,14 @@ const file_authzen_v1_authzen_service_proto_rawDesc = "" + " \"page\": {\"limit\": 50}\n" + "}\n" + "```\n" + - "*\fActionSearch\x82\xd3\xe4\x93\x02/:\x01*\"*/stores/{store_id}/access/v1/search/action\x12\xca\n" + + "*\fActionSearch\x82\xd3\xe4\x93\x02/:\x01*\"*/stores/{store_id}/access/v1/search/action\x12\xcb\n" + "\n" + - "\x10GetConfiguration\x12#.authzen.v1.GetConfigurationRequest\x1a$.authzen.v1.GetConfigurationResponse\"\xea\t\x92A\xb1\t\x12=[Experimental] Get AuthZEN PDP configuration and capabilities\x1a\xdd\b[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n" + + "\x10GetConfiguration\x12#.authzen.v1.GetConfigurationRequest\x1a$.authzen.v1.GetConfigurationResponse\"\xeb\t\x92A\xb2\t\x12=[Experimental] Get AuthZEN PDP configuration and capabilities\x1a\xde\b[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n" + "\n" + "Following the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at `/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n" + "\n" + "## Example Response\n" + + "\n" + "```json\n" + "{\n" + " \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n" + From e2ff0f84ba489d7e7e54b995d3ed190531ae8989 Mon Sep 17 00:00:00 2001 From: Nick Gagliardi Date: Wed, 30 Sep 2026 14:58:01 -0400 Subject: [PATCH 3/3] fix v2 --- docs/openapiv2/apidocs.swagger.json | 2 +- docs/openapiv3/apidocs.openapi.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/openapiv2/apidocs.swagger.json b/docs/openapiv2/apidocs.swagger.json index 5d687b79..5f1bc655 100644 --- a/docs/openapiv2/apidocs.swagger.json +++ b/docs/openapiv2/apidocs.swagger.json @@ -2953,7 +2953,7 @@ "NULL_VALUE" ], "default": "NULL_VALUE", - "description": "Represents a JSON `null`.\n\n`NullValue` is a sentinel, using an enum with only one value to represent\nthe null value for the `Value` type union.\n\nA field of type `NullValue` with any value other than `0` is considered\ninvalid. Most ProtoJSON serializers will emit a Value with a `null_value` set\nas a JSON `null` regardless of the integer value, and so will round trip to\na `0` value.\n\n - NULL_VALUE: Null value." + "description": "`NullValue` is a singleton enumeration to represent the null value for the\n`Value` type union.\n\nThe JSON representation for `NullValue` is JSON `null`.\n\n - NULL_VALUE: Null value." }, "Object": { "type": "object", diff --git a/docs/openapiv3/apidocs.openapi.json b/docs/openapiv3/apidocs.openapi.json index 1028b35b..7149f4d7 100644 --- a/docs/openapiv3/apidocs.openapi.json +++ b/docs/openapiv3/apidocs.openapi.json @@ -1220,7 +1220,7 @@ }, "NullValue": { "default": "NULL_VALUE", - "description": "Represents a JSON `null`.\n\n`NullValue` is a sentinel, using an enum with only one value to represent\nthe null value for the `Value` type union.\n\nA field of type `NullValue` with any value other than `0` is considered\ninvalid. Most ProtoJSON serializers will emit a Value with a `null_value` set\nas a JSON `null` regardless of the integer value, and so will round trip to\na `0` value.\n\n - NULL_VALUE: Null value.", + "description": "`NullValue` is a singleton enumeration to represent the null value for the\n`Value` type union.\n\nThe JSON representation for `NullValue` is JSON `null`.\n\n - NULL_VALUE: Null value.", "enum": [ "NULL_VALUE" ],